popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sisifo_setup.exe

PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 May 19, 2021, 1:47 p.m. May 19, 2021, 1:50 p.m.
Size 3.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 7e57d2438a4c8daa0605baf3d1074a67
SHA256 14a7ff2c7d857145ffcd7464e4a2234474bde74af1d50f397a6cbdcf5c5a2925
CRC32 7B6A88C9
ssdeep 98304:szqXXC79pjuyKZMgK854uJOLGqoTZu4FA8osZ:FXS7/u3ZMgK8HampFHX
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73dd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74e51000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72da4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsz24.tmp\InstallOptions.dll
file C:\Users\test22\AppData\Local\Temp\nsz24.tmp\InstallOptions.dll
host 172.217.25.14
MicroWorld-eScan Trojan.GenericKD.41750562
FireEye Trojan.GenericKD.41750562
McAfee Artemis!7E57D2438A4C
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanSpy:Win32/Stealer.8a4e31fc
K7GW Riskware ( 0040eff71 )
Cybereason malicious.38a4c8
Arcabit Trojan.MSILPerseus.D32547, Trojan.Bulz.D30D40
Cyren W32/Trojan.LYQE-0325
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender Trojan.GenericKD.41750562
NANO-Antivirus Trojan.Win32.Stealer.ibghvw
Paloalto generic.ml
Sophos Mal/Generic-S
Comodo Malware@#17prqzzxyxhp0
F-Secure Trojan.TR/Spy.Stealer.tster
TrendMicro TROJ_GEN.R06BC0WIB20
McAfee-GW-Edition RDN/Generic PWS.y
Emsisoft Trojan.GenericKD.41750562 (B)
Avira TR/Spy.Stealer.tster
Antiy-AVL Trojan[Spy]/MSIL.Stealer
Gridinsoft Ransom.Win32.Wacatac.oa!s5
Microsoft VirTool:MSIL/CryptInject
AegisLab Trojan.MSIL.Stealer.l!c
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
GData Gen:Variant.Bulz.200000
Cynet Malicious (score: 85)
BitDefenderTheta Gen:NN.ZemsilCO.34780.ciW@aOSXh4o
ALYac Gen:Variant.Bulz.200000
MAX malware (ai score=89)
VBA32 TrojanSpy.MSIL.Stealer
TrendMicro-HouseCall TROJ_GEN.R06BC0WIB20
Tencent Msil.Trojan-spy.Stealer.Ajvr
Fortinet W32/Stealer!tr
AVG Win32:Malware-gen
Panda Trj/CI.A
Qihoo-360 Generic/Trojan.Spy.67f